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DETAILED ACTION 
Continued Examination under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 02/09/2009 has been entered. The amendment to 
the specification to change the title of application is reviewed and accepted. Claims 1, 12 and 17 
are amended. Claims 1-20 are currently pending. 

2. Amendment received on 08/20/2008 has been entered into record. Claims 1, 12-13 and 
17-20 are amended. 

Priority 

3. This application has claimed priority from provisional application 60528643 filed on 
12/10/2003. The filing date is 03/30/2004. 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject matter 
sought to be patented and the prior art are such that the subject matter as a whole would have 
been obvious at the time the invention was made to a person having ordinary skill in the art 
to which said subject matter pertains. Patentability shall not be negatived by the manner in 
which the invention was made. 

Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley et al. (US 
7277957 B2), hereinafter referred as Rowley and further in view of Saulpaugh et al. (US 
7072967 Bl), hereinafter referred as Saulpaugh. 

a. Rowley shows (claim 1) an apparatus (Fig. 1 and Fig. 2) comprising: a network 
interface module to connect the apparatus to a network (column 3, lines 28-33; 
Ethernet card as a network tap device); a packet capture module to intercept packets 
being transmitted on the network (column 3, lines 33-35: a packet capture engine); an 
object assembly module to reconstruct flows representing objects being transmitted 
on the network from the intercepted packets (column 4, lines 9-12: packets are 
sequentially read, decoded, checked and added to the protocol sorted list until the last 
packet has been retrieved; column 4, lines 29-34: data from the selected packets may 
be reconstructed into data files and script files used to display web pages and other 
content; column 6, lines 59-65: local cache holding word processing documents, PDF 
files, audio files and video files); an object classification module to determine a type 
of content of (column 4, lines 63-65: determine the type of packets; column 6, lines 6- 
1 1 : packet indicates a script file type to be displayed as page, e.g. HTML, Java Script 
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and Active Server Pages; multi-packet recompilation module set similar directories 
for local cache of files) and reconstruct objects from flows (column 4, lines 9-12: 
packets are sequentially read, decoded, checked and added to the protocol sorted list 
until the last packet has been retrieved; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files); an object store 
module to store the objects (column 4, lines 9-12: packets are sequentially read, 
decoded, checked and added to the protocol sorted list until the last packet has been 
retrieved); and a user interface to enable a user to search objects stored in the object 
store module (column 7, line 66-column 8, line 1 : web browser or display program 
capable display text, graphic and other visual information on a computer monitor). 
Rowley does not show (claim 1) wherein the objects are searched based a query, 
which includes search criteria used to identify selected objects that match the search 
criteria. However using browser to search and identify objects based upon search 
criteria seems to be known to one skill in the art. 

b. Saulpaugh shows search based on search criteria (column 33, line 55-column 34, line 
3); database query based upon name or strings (column 41, line 60-column 42, lines 
10); query results cache (column 48, lines 33-52); and search tag may contain 
optional set of search criteria (column 64, line 10-column 65, line 9) in an uruilogon > 
art for the purpose of efficient construction of message endpoints. 

c. x - - e - -\ - ^ \ - v- v - . s s :> a? the its"*! onh 
invention w as m>„k t. - ; noJiiy Rowley's functions of reconstructing network 
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communications with Saulpaugh's functions of message query based on name or 
string. 

would have been noth at d to data selection or query based on name or string as per 
Saulpaugh's teaching in support the display of data collected and reconstructed as per 
Rowley (column 1, lines 54-65) and Saulpaugh (column 82, lines 28-52)'s teaching. 

e. Regarding claim 2, Rowley shows wherein the object assembly module comprises a 
reassembler to assemble the intercepted packets into flows (column 4, lines 9-12: 
packets are sequentially read, decoded, checked and added to the protocol sorted list 
until the last packet has been retrieved; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files). 

f. Regarding claim 3, Rowley shows wherein the object assembly module further 
comprises a protocol demultiplexer to sort the assembled flows by protocol (column 
4, lines 9-12: packets are sequentially read, decoded, checked and added to the 
protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 4, Rowley shows wherein the object assembly module further 
comprises a protocol classifier to extract the objects from the sorted assembled flows 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 



Application/Control Number: 10/815 ,240 Page 6 

Art Unit: 2444 

local cache holding word processing documents, PDF files, audio files and video 
files). 

h. Regarding claim 5, Rowley shows wherein the object classification module 
determines whether objects are stored in the object store or discarded based on one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network communication session). 

i. Regarding claim 6, Rowley shows wherein the capture rules are user-configurable 
through the user interface (column 1, line 66-column 2, line 9: selecting a portion of 
the packets captured by a sniffer during a giving time interval; column 3, lines 43-47: 
selecting captured data during a specified time interval). 

j. Regarding claim 7, Rowley shows wherein the object classification module 

determines a location that each object is stored in the object store based on the type of 
content of each object (column 6, lines 38-48: directory structure based on image file 
type; column 6, lines 49-65: directory structure for graphics files, text files, audio 
files and video files). 

k. Regarding claim 8, Saulpaugh sho ws wherein the object classification module 

determines the type of content of each object using a signature of each object (column 
82, lines 28-52: an object signature may be included to identify the object's class). 

1. Regarding claim 9, Rowley shows wherein the user interface comprises a graphical 
user interface (column 7, line 66-column 8, line 1 : web browser or display program 
capable display text, graphic and other visual information on a computer monitor). 
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Together Rowley and Saulpaugh disclosed all limitations of claims 1-9. Claims 1-9 are 

rejected under 35 U.S.C. 103(a). 
5. Claims 10-11 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley, 
Saulpaugh and further in view of Barnett et al. (US 7290048 Bl), hereinafter referred as Barnett. 

a. Rowley shows claim 1 as above. \e :lvr Rowley w Saulpaugh shows (claim 10) 
wherein the object store module comprises a c> m - i store to store the objects and a 
tag store to index the objects stored in the object store. However, Rowley Ji>-. • ^ 
identifying protocol and collecting packets into a protocol sorted list; selecting, 
reconstructing and displaying data information, e.g. web pages, from a protocol 
session. 

b. Barnett shows (claim 10) wherein the object store module comprises a content store 
to store the objects and a tag store to index the objects stored in the object store 
(column 10, lines 52-61 : tags and other columns support transaction recognition, 
pointer to original sources of data for traceability; column 22, lines 18-37: tags 
interpreted are time, data, file name, line numbers, graph object types, source, 
destination and tool tip information) in an analogous art for the purpose of data 
collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 

c. It would have been obvious to a person of ordinary skill in die an. ai the time of die 
" * o >v : N . v ,e - ' ^ Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of message query based on name or 
string and Barnett' s functions of using tags in support of performance analysis. 
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d s v. xv. 

w^uld ii t\ v boon nvi^ tv , tag and identify data as per Barnett's teaching in 
support the data collection and reconstruct as per Rowley (column 1, lines 54-65), 
Saulpaugh (column 82, lines 28-52) and Barnett (column 7, lines 35-45)'s teaching. 

e. Regarding claim 11, Barnett shows wherein the content store comprises a canonical 
storage, and the tag store comprises a database (column 12, lines 4-12: canonical 
form for abstract module, sources supply lines information form text file, binary file 
or database; column 13, lines 26-48: data consists of network traces consisting of 
arrays mutated into hash tables to be addresses by column header vs. row and column 
locations). 

Together Rowley, Saulpaugh and Barnett disclosed all limitations of claims 10-11. Claims 
10-11 are rejected under 35 U.S.C. 103(a). 
6. Claims 12-20 are rejected under 35 U.S.C. 1 03(a) as being unpatentable over Rowley in 
view of Saulpaugh and Barnett. 

a. Rowley shows (claim 12) an method comprising: intercepting data being transmitted 
on a network (column 3, lines 33-35: a packet capture engine); reconstructing flows 
of objects being transmitted on the network from the intercepted data (column 4, lines 
9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved; column 4, lines 29-34: data from 
the selected packets may be reconstructed into data files and script files used to 
display web pages and other content; column 6, lines 59-65: local cache holding word 
processing documents, PDF files, audio files and video files); classifying the 
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reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages); and storing the classified 
objects (column 4, lines 9-12: packets are sequentially read, decoded, checked and 
added to the protocol sorted list until the last packet has been retrieved). Rowley does 
not show (claim 12) creating a tag to describe each reconstructed object; storing tags; 
indexing the stored objects to enable searching of the stored objects via the tags; and 
wherein the objects are searched based on a query, which includes search criteria used 
to identify selected objects that match the search criteria. I k>v> < \ \\ Rowley docs 
show identifying protocol and collecting packets into a protocol sorted list as per IP 
address and port number to categorize packets (column 4, lines 42-65); selecting, 
reconstructing and displaying data information, e.g. web pages, from a protocol 
session, including the directory and file structures (column 7, lines 37-51). 
b. Barnett shows (claim 12) creating a tag to describe each reconstructed object; storing 
tags; storing tags; indexing the stored objects to enable searching of the stored objects 
via the tags (column 10, lines 52-61 : tags and other columns support transaction 
recognition, pointer to original sources of data for traceability; column 22, lines 18- 
37: tags interpreted are time, data, file name, line numbers, graph object types, 
source, destination and tool tip information) 1 ^ „o > jn uvik- N v of 
data collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 
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c. Saulpaugh shows search based on search criteria (column 33, line 55-column 34, line 
3); database query based upon name or strings (column 41, line 60-column 42, lines 
10); query results cache (column 48, lines 33-52); and search tag may contain 
optional set of search criteria (column 64, line 10-column 65, line 9) in an analogous 
an tin the pusposc of efficient construction of message endpoints. 

invasion was ou-Jc rv \ Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of message query based on name or 
string and Barnctt's functions of using tags in support of performance analysis. 

e. The modification would have been obvious because one of ordinary skill in the art 
would have been motivated to tag and identify data as per Barnett's teaching in 
support the data collection and reconstruct as per Rowley (column 1 , lines 54-65), 
Saulpaugh (column 82, lines 28-52) and Barnett (column 7, lines 35-45)'s teaching. 

f. Regarding claim 13, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 14, Rowley shows further comprising determining whether each 
object is to be stored based on a set of one or more capture rules (column 3, lines 62- 
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67: packet not needed for the subsequent reconstruction of the network 
communication session). 

h. Regarding claim 15, Saulpaugh shows further comprising receiving a query over the 
stored objects (column 27, lines 10-29: query for a message response). 

i. Regarding claim 16, Saulpaugh shows further comprising searching the indexed 
objects, and retrieving objects matching the query (column 41, line 60-column 42, 
lines 10: database query based upon name or strings; column 48, lines 33-52: query 
results cache); 

j. Regarding claim 17, Rowley shows an machine-readable storage medium having 
stored thereon data representing instructions (Fig. 1 and Fig. 2) that, when executed 
by a processor, cause the processor to perform operations comprising: intercepting 
data being transmitted on a network (column 3, lines 33-35: a packet capture engine); 
reconstructing objects being transmitted on the network from the intercepted data 
(column 4, lines 29-34: data from the selected packets may be reconstructed into data 
files and script files used to display web pages and other content); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages); and storing the classified 
objects (column 4, lines 9-12: packets are sequentially read, decoded, checked and 
added to the protocol sorted list until the last packet has been retrieved). Barnett 
shows creating a tag to describe each reconstructed object; storing tags; storing tags; 
indexing the stored objects to enable searching of the stored objects via the tags 
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(column 10, lines 52-61 : tags and other columns support transaction recognition, 
pointer to original sources of data for traceability; column 22, lines 18-37: tags 
interpreted are time, data, file name, line numbers, graph object types, source, 
destination and tool tip information). Saulpaugh shows search based on search criteria 
(column 33, line 55-column 34, line 3); database query based upon name or strings 
(column 41, line 60-column 42, lines 10); query results cache (column 48, lines 33- 
52); and search tag may contain optional set of search criteria (column 64, line 10- 
column 65, line 9). 

k. Regarding claim 18, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

1. Regarding claim 19, Rowley shows wherein the instructions further cause the 
processor to determine whether each object is to be stored based on a set of one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network communication session). 

a. Regarding claim 20, Saulpaugh shows wherein the instructions further cause the 
processor to receive a query over the stored objects, search the indexed objects in 
response to the query, and retrieve objects matching the query (column 27, lines 10- 
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29: query for a message response; column 41, line 60-column 42, lines 10: database 
query based upon name or strings; column 48, lines 33-52: query results cache). 

Together Rowley, Saulpaugh and Barnett disclosed all limitations of claims 12-20. Claims 

12-20 are rejected under 35 U.S.C. 103(a). 
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Response to Arguments 

7. Applicant's arguments filed on 02/09/2009 have been fully considered, but they are not 
persuasive. 

a. Applicant has amended independent claims 1,12 and 17 with the limitation of 
"wherein the objects are searched based a query, which includes search criteria used 
to identify selected objects that match the search criteria" and argued that no 
references cited have disclosed the limitation (see 2 nd to last paragraph on page 7 of 
current amendment). 

b. Examiner has reviewed the amended claim change in light of applicant's original 
specification and claim set and found description on the limitation in paragraph 34 of 
applicant specification. Examiner has reviewed the claim rejections as per office 
action mailed on 1 1/07/2008 and applied prior arts. Saulpaugh was brought to show 
claims 15 and 16 on receiving a query for searching a indexed objected matching the 
query. Examiner has further searched on the current amended limitation, especially 
on searching based upon search criteria. Examiner has found Saulpaugh has shown as 
paragraph 34 of applicant specification similar function in column 33, line 55-column 
34, line 3: search based on search criteria; in column 41, line 60-column 42, lines 10: 
database query based upon name or strings; in column 48, lines 33-52: query results 
cache; and in column 64, line 10-column 65, line 9: search tag may contain optional 
set of search criteria. Using browser in query based on a combination of names or text 
seems to be well known to one skill in the art as shown above in Saulpaugh's 
disclosure. Claim rejections are updated to reflect current claim amendments. 
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Conclusion 

8. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Refer to the enclosed PTO-892 for details. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peling A. Shaw whose telephone number is (571) 272-7968. The 
examiner can normally be reached on M-F 8:00 - 4:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William C. Vaughn can be reached on (571) 272-3922. The fax phone number for 
the organization where this application or proceeding is assigned is (571) 273-8300. 

Information regarding the statu9s of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



/Peling A Shaw/ 
Examiner, Art Unit 2444 



